17 أسطر
861 B
YAML
17 أسطر
861 B
YAML
# Brute Force Detection Alert Rule (Ghaymah Monitor / Prometheus Format)
|
|
groups:
|
|
- name: SecOps_Alerts
|
|
rules:
|
|
- alert: HighLoginFailures_BruteForce
|
|
expr: rate(http_requests_total{path="/api/login", status="401"}[5m]) > 20
|
|
for: 2m
|
|
labels:
|
|
severity: critical
|
|
team: secops
|
|
mitre_tactic: "TA0006 - Credential Access"
|
|
mitre_technique: "T1110 - Brute Force"
|
|
annotations:
|
|
summary: "Potential Brute Force Attack on API Login detected"
|
|
description: "Detected a high rate of failed login attempts (HTTP 401) on /api/login from IP: {{ $labels.client_ip }}. Rate exceeds 20 requests per second over the last 5 minutes."
|
|
mitigation: "Check WAF logs immediately, apply Rate Limiting for the offending IP, and verify if any recent 200 OK responses occurred."
|